Bump github/codeql-action from 4.37.5 to 4.37.6

[dependabot]

Bumps github/codeql-action from 4.37.5 to 4.37.6.

Release notes

Sourced from github/codeql-action's releases.

v4.37.6

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Changelog

Sourced from github/codeql-action's changelog.

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

Commits

• 5595cca Merge pull request #4071 from github/update-v4.37.6-6a9359a1b
• ec9c757 Add change note for PR 4070
• 45c8742 Update changelog for v4.37.6
• 6a9359a Merge pull request #4070 from github/mbg/remote-address/change-file-default
• 065cdc0 Change DEFAULT_CONFIG_FILE_NAME
• f99dd5a Merge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.2
• 1804b21 Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a1
• 3020a2f Rebuild
• 93c3a5a Update changelog and version after v4.37.5
• 266c7bd Rebuild
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.98%. Comparing base (d9aaf69) to head (33bacd7).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13339   +/-   ##
=======================================
  Coverage   98.98%   98.98%           
=======================================
  Files         132      132           
  Lines       49073    49073           
  Branches     2553     2553           
=======================================
  Hits        48576    48576           
  Misses        373      373           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	22.13% <ø> (ø)
CI-GHA	98.90% <ø> (+<0.01%)	⬆️
OS-Linux	98.67% <ø> (+<0.01%)	⬆️
OS-Windows	97.03% <ø> (ø)
OS-macOS	97.92% <ø> (-0.01%)	⬇️
Py-3.10	98.12% <ø> (ø)
Py-3.11	98.37% <ø> (+<0.01%)	⬆️
Py-3.12	98.46% <ø> (ø)
Py-3.13	98.44% <ø> (-0.01%)	⬇️
Py-3.14	98.46% <ø> (ø)
Py-3.14t	97.55% <ø> (-0.01%)	⬇️
Py-pypy-3.11	97.39% <ø> (ø)
VM-macos	97.92% <ø> (-0.01%)	⬇️
VM-ubuntu	98.67% <ø> (+<0.01%)	⬆️
VM-windows	97.03% <ø> (ø)
cython-coverage	37.96% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will degrade performance by 8.65%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 83 untouched benchmarks
⏩ 83 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_resolve_gitapi	599.4 ms	656.1 ms	-8.65%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/github_actions/github/codeql-action-4.37.6 (33bacd7) with master (d9aaf69)}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩